Skip to main content
Control Institute
Category: Business Continuity

Emergency Communication Plan

Also known as: Crisis Communication Plan, Emergency Communications Plan, Disaster Communication Plan
Simply put

An emergency communication plan is a documented, step-by-step guide that defines how an organization will share information during an emergency or disruption, including when to communicate, through what channels, and with which people. It helps an organization respond promptly and accurately when a crisis occurs. Depending on the setting, such plans may address families, businesses, or institutions.

Formal definition

An emergency communication plan is a strategic set of policies and procedures specifying when, how, and with whom an organization will communicate during an emergency, coordinating internal and external messaging in the hours and days following a disruptive event. In a business context, it typically identifies stakeholders, communication channels, escalation paths, and responsible parties to enable prompt, accurate, and confident response. Such plans support broader continuity and incident-response objectives; their specific scope, content, and audiences vary by organization and are set by the entity's own scoping and risk decisions.

Why it matters

When a disruptive event occurs, the quality and speed of an organization's response often depend less on the event itself than on how effectively information moves through the organization and out to affected parties. An emergency communication plan addresses this directly by predefining who speaks, to whom, through which channels, and at what point in an unfolding situation. Without such a plan, organizations risk delayed, contradictory, or inaccurate messaging at precisely the moment when clarity matters most. As guidance from Ready.gov emphasizes, a business must be able to respond promptly, accurately, and confidently during an emergency in the hours and days following a disruptive event.

For compliance-focused organizations, an emergency communication plan is a practical component of broader business continuity and incident-response programs. In a SOC 2 examination, communication during incidents can be relevant to how an organization demonstrates its incident-response and monitoring activities under the Security (Common Criteria) category, and, depending on scope, to categories such as Availability. In an ISO/IEC 27001 context, communication planning supports the operational and incident-management expectations of an information security management system, though the specific requirements an organization must satisfy depend on its Statement of Applicability and its own risk assessment. In both cases, the plan is one contributing element rather than a standalone guarantee of resilience.

It is important to recognize the limits of what such a plan provides. An emergency communication plan governs how information is coordinated and shared; it does not by itself prevent incidents, ensure availability of systems, or substitute for the underlying continuity and recovery controls it supports. Its effectiveness also depends on the organization's own scoping decisions, which determine the stakeholders, channels, and escalation paths it addresses.

Who it's relevant to

Business Continuity and Incident Response Teams
These teams rely on an emergency communication plan to coordinate internal and external messaging during a disruption, ensuring stakeholders are reached through defined channels and escalation paths. The plan supports their broader continuity and incident-response objectives, helping the organization respond promptly and accurately in the hours and days following an event.
Compliance and GRC Professionals
For those managing SOC 2 examinations or ISO/IEC 27001 certification, communication planning can contribute to how incident-response and operational expectations are demonstrated. Its relevance depends on scope, such as which Trust Services Criteria are selected or what an ISO 27001 Statement of Applicability includes, so the plan should be aligned with the organization's own scoping and risk decisions rather than treated as a universal requirement.
Institutions and Educational Organizations
Colleges, universities, and similar institutions use crisis communication plans to coordinate communication across internal units and with external audiences. These plans establish policies and procedures for consistent messaging during emergencies affecting the institution and its community.
Families and Households
Outside the organizational setting, emergency communication plans help families prepare for how they will share information and reunite during an emergency. Tools such as the Family Emergency Communication Plan template capture practical details, including information for schools and childcare, so household members know how to reach one another.

Inside Emergency Communication Plan

Stakeholder Contact Roster
A maintained list of internal and external parties who must be reached during an incident, typically including incident response team members, executive leadership, affected customers, regulators, and relevant third parties, with defined primary and backup contact methods.
Escalation Paths and Triggers
Predefined criteria that determine when and to whom communications are escalated, so that events of differing severity route to the appropriate decision-makers. The specific thresholds vary depending on scope and organizational risk tolerance.
Notification Timelines and Obligations
Documented expectations for how quickly affected parties and authorities are informed, reflecting any contractual or regulatory obligations applicable to the organization. Exact timeframes depend on the commitments and jurisdictions in scope rather than a universal rule.
Approved Message Templates and Channels
Pre-drafted communication content and the designated channels (such as email, phone, or status pages) used to deliver consistent, accurate information under time pressure, often with a defined approval step before external release.
Roles and Responsibilities
Assignment of who authorizes, drafts, reviews, and delivers communications, including a designated spokesperson or point of contact, to avoid conflicting or unauthorized messaging during an event.
Testing and Maintenance Provisions
Arrangements for periodically exercising and updating the plan so contact details, obligations, and procedures remain current. The frequency and format of such testing typically depend on the organization's scope and risk assessment.

Common questions

Answers to the questions practitioners most commonly ask about Emergency Communication Plan.

Is an emergency communication plan a mandatory control required by SOC 2 or ISO 27001?
Neither framework prescribes an emergency communication plan as a single, named mandatory control. Under SOC 2, communication-related expectations flow from the Common Criteria concerning internal and external communication, and how they are met depends on the auditor, scope, and selected Trust Services Criteria. Under ISO 27001, the ISMS requirements in clauses 4 through 10 address communication (notably the clause on communication), while any specific incident or crisis communication measures are typically selected from Annex A reference controls via the Statement of Applicability, informed by risk assessment. In most engagements an emergency communication plan supports these requirements rather than being an absolute obligation in itself, so its necessity depends on scope and risk.
Does having an emergency communication plan in place guarantee that an organization will pass its SOC 2 examination or achieve ISO 27001 certification?
No. A SOC 2 report is an attestation examination performed by a licensed CPA firm under the AICPA SSAE 18 standard, and it attests only to the controls and the period covered; it does not guarantee freedom from incidents or breaches. ISO 27001 certification is issued by an accredited certification body against the management system standard and covers only the defined scope of the ISMS. An emergency communication plan may support relevant criteria or requirements, but a SOC 2 outcome depends on the suitability of design (Type I) or design and operating effectiveness over a review period (Type II), and an ISO 27001 outcome depends on the ISMS as a whole. A single plan does not by itself determine either result.
Who should be identified in an emergency communication plan?
In most implementations, the plan identifies the individuals or roles responsible for initiating, approving, and delivering communications, along with internal recipients (such as leadership, affected teams, and staff) and external parties (such as customers, regulators, and other stakeholders where applicable). Because SOC 2's Common Criteria address both internal and external communication, and ISO 27001 clause 4 requires identifying interested parties, aligning the plan's contacts with these considerations is typically useful. The specific roles included depend on the organization's scope, structure, and risk assessment.
How does an emergency communication plan relate to incident response procedures?
An emergency communication plan is typically one component of a broader incident response process rather than a replacement for it. Incident response generally covers detection, containment, eradication, and recovery, while the communication plan governs how information is conveyed to internal and external parties during and after an event. In practice, organizations often reference the communication plan from within their incident response documentation so that notification steps are triggered at the appropriate points, though the exact integration depends on scope and how the organization has structured its controls.
How often should an emergency communication plan be reviewed or tested?
The frequency varies and is set by the organization's own policies, risk assessment, and any expectations from its auditor or certification body. Many organizations review and test communication procedures periodically and after significant changes or actual incidents, so that contact information and escalation paths remain accurate. For a SOC 2 Type II examination, evidence that the plan operated over the review period may be relevant, while for ISO 27001 the emphasis is on demonstrating that the ISMS, including relevant communication activities, is maintained and improved. No fixed universal interval applies across all engagements.
What evidence supports an emergency communication plan during an audit or assessment?
Typical evidence includes the documented plan itself, records of reviews and updates, contact and escalation lists, and artifacts from tests or actual activations such as notifications sent or after-action notes. For a SOC 2 Type I examination the focus is generally on the suitability of design at a point in time, whereas a Type II examination assesses operating effectiveness over a defined period and may look for evidence of the plan being used or exercised. For ISO 27001, assessors typically look for evidence consistent with the ISMS requirements and any related Annex A controls selected through the Statement of Applicability. The precise evidence expected depends on the auditor, certification body, and scope.

Common misconceptions

Having an Emergency Communication Plan documented is sufficient to demonstrate control effectiveness in a SOC 2 or ISO 27001 assessment.
A documented plan addresses design, but in a SOC 2 Type II examination an auditor also evaluates operating effectiveness over the review period, and under ISO 27001 the plan is expected to function as part of the ISMS and be maintained and tested. Existence of a document alone does not establish that controls operated as intended.
An Emergency Communication Plan guarantees that stakeholders will always be notified correctly and that incidents will be contained.
A SOC 2 report attests only to the controls and period covered and does not guarantee freedom from breaches or flawless execution, and an ISO 27001 certificate covers only the defined ISMS scope. The plan supports response but does not by itself assure any outcome.
One Emergency Communication Plan satisfies the communication-related expectations of both SOC 2 and ISO 27001 identically.
Mapping between the two frameworks is possible but partial, and satisfying one does not automatically satisfy the other. The specific criteria under the Trust Services Criteria and the ISMS requirements of ISO 27001 differ, so the plan may need to address each framework's expectations distinctly depending on scope.

Best practices

Maintain contact rosters and escalation paths as living records, reviewing them on a defined cadence so that details remain accurate between assessments.
Align notification timelines and obligations to the actual contractual and regulatory commitments in scope, rather than assuming a single fixed deadline applies universally.
Prepare and pre-approve message templates and designated channels so communications can be released consistently under time pressure without ad hoc drafting.
Clearly assign roles and a designated point of contact for authorizing and delivering communications to prevent conflicting or unauthorized messaging.
Exercise the plan periodically and retain evidence of those tests, since a SOC 2 Type II examination and an ISO 27001 ISMS both benefit from demonstrable operating effectiveness over time.
Integrate the plan into the broader incident response and ISMS processes so it reflects the defined scope and remains coordinated with related controls rather than standing alone.